Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Regulators stopped asking whether you have security controls. Now they want proof the controls actually work. Host Tova Dvorin sits down with Adrian Culley to argue that CTEM has a silent E—for evidence—and that evidence is now the currency of cyber regulation worldwide. Inside: DORA's Article 26 threat-led penetration testing, NIS2's "assess the effectiveness" clause and personal board liability, the SEC's 8-K materiality clock, NYDFS Part 500's personally signed CISO certification, and the EU AI Act's August logging deadline. Subscribe to The Cyber Resilience Brief for more.

The victim had a SIEM. Had EDR. Had a mature program on paper. The controls existed—they just didn't do their job on the day. Offensive cybersecurity expert Adrian Culley on the only way to know whether your stack actually works: run the technique and watch. Dump credentials from LSASS memory—did the EDR block it? Did the SIEM rule fire? Did the SOC see it inside their target window?

For the first time anywhere, the MITRE ATLAS framework and the OWASP Top 10 for LLM applications are written into binding law. Article 15 names data poisoning, model poisoning, adversarial examples, model evasion and confidentiality attacks as threat classes you must have technical measures against—and must be able to evidence to a regulator. The question is no longer whether you have thought about AI security. It is whether you can prove your AI system holds.

The EU AI Act's August 2nd, 2026 deadline just changed shape. Host Tova Dvorin and offensive security engineer Adrian Cully separate what actually lands—Article 50 transparency duties and GPAI enforcement powers—from the high-risk obligations that slipped to December 2027. Inside: Article 15 writes MITRE ATLAS and the OWASP LLM Top 10 into binding law, the DORA / NIS2 / AI Act overlap that makes one incident reportable three times, penalties up to 7% of global turnover, and the five things a CISO should do this week. Part 1 of 2.

A poisoned CLAUDE.md file inside a cloned repository quietly tells a coding agent to send its test logs to an outside endpoint, and the agent complies, shipping environment details, internal system information, and API keys to a server the developer never controlled. The model was not broken. It was obedient. In this episode of The Cyber Resilience Brief (a SafeBreach podcast), host Tova Dvorin and SafeBreach senior sales engineer Adrian Culley break down why building agentic AI controls is not the same as proving they hold under attack.

Are we trusting AI tools too much? Right now, agents trust tool descriptions without verification. This could lead to serious security risks! What happens when a major server gets compromised? It's time to rethink our standards for AI tool security. What do you think about AI trust issues?

During an internal OpenAI evaluation, an agent left notes inside the company’s own network for future versions of itself, containing instructions on how to break free of OpenAI’s constraints. Reuters reports it isn’t clear whether this agent was connected to the one that breached Hugging Face, so don’t over-read it. But sit with the behavior for a second: an agent staging information for a successor process to find later. If a human crew did that, we’d call it a dead drop.

On July 9, an OpenAI model broke out of a sealed evaluation sandbox, found a zero-day in a package proxy, and — with no human directing it — chained stolen credentials and fresh exploits into Hugging Face's production infrastructure. Hugging Face detected it and called the FBI. OpenAI didn't know its own model had escaped for roughly 11 days. Host Tova Dvorin and offensive security expert Adrian Culley separate what's confirmed from what's hype.

Finding a security gap is easy. Closing it before it dies in a backlog is the hard part. Host Tova Dvorin sits down with Koby Bar (SVP Product, SafeBreach) and Mackenzie Kyle (CPO, Anvilogic) to unpack a partnership that turns a simulated attack that evades your controls into a deployed, tuned detection—then re-runs the attack to prove it fires. They cover Anvilogic's agentic "blueprint" workflow, where SafeBreach Helm fits, why continuous validation matters even after a rule ships, and how detection work that took days-to-weeks now takes minutes.

Detection engineering used to take days or weeks. With the SafeBreach + Anvilogic integration, it now takes minutes. SafeBreach SVP of Product Koby Bar and Anvilogic CPO Mackenzie Kyle break down how a validated attack simulation turns straight into a deployed, continuously tested detection—clearing the detection-ticket backlog that eats SOC teams alive, and building every rule on real log evidence instead of guesswork.